diff mbox series

[01/16] fwhosts.cgi Fix for bug 13876 & bug 13877

Message ID 20250925111252.11893-1-adolf.belka@ipfire.org
State Staged
Commit 47e9f8470ad5f8c134ad36e125bd7d6d78b61b7f
Headers
Series [01/16] fwhosts.cgi Fix for bug 13876 & bug 13877 |

Commit Message

Adolf Belka 25 Sep 2025, 11:12 a.m. UTC 
Fixes: Bug 13876 savelocationgrp COUNTRY_CODE Stored Cross-Site Scripting
Fixes: Bug 13877 saveservice PROT Stored Cross-Site Scripting
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 html/cgi-bin/fwhosts.cgi | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

Comments

Bernhard Bitsch 25 Sep 2025, 12:47 p.m. UTC | #1 
Reviewed-by: Bernhard Bitsch <bbitsch@ipfire.org>

Am 25.09.2025 um 13:12 schrieb Adolf Belka:
> Fixes: Bug 13876 savelocationgrp COUNTRY_CODE Stored Cross-Site Scripting
> Fixes: Bug 13877 saveservice PROT Stored Cross-Site Scripting
> Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
> ---
>   html/cgi-bin/fwhosts.cgi | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/html/cgi-bin/fwhosts.cgi b/html/cgi-bin/fwhosts.cgi
> index 953f81e5f..a666969b0 100644
> --- a/html/cgi-bin/fwhosts.cgi
> +++ b/html/cgi-bin/fwhosts.cgi
> @@ -2,7 +2,7 @@
>   ###############################################################################
>   #                                                                             #
>   # IPFire.org - A linux based firewall                                         #
> -# Copyright (C) 2013 Alexander Marx <amarx@ipfire.org>                        #
> +# Copyright (C) 2013-2025  IPFire Team  <info@ipfire.org>                     #
>   #                                                                             #
>   # This program is free software: you can redistribute it and/or modify        #
>   # it under the terms of the GNU General Public License as published by        #
> @@ -714,7 +714,7 @@ if ($fwhostsettings{'ACTION'} eq 'savelocationgrp')
>   	}
>   
>   	if ($fwhostsettings{'update'} eq 'on'){
> -		@target=$fwhostsettings{'COUNTRY_CODE'};
> +		@target=&Header::escape($fwhostsettings{'COUNTRY_CODE'});
>   		$type='Location Group';
>   
>   		#check if host/net exists in grp
> @@ -796,7 +796,7 @@ if ($fwhostsettings{'ACTION'} eq 'saveservice')
>   		foreach my $i (0 .. 4) { $customservice{$key}[$i] = "";}
>   		$customservice{$key}[0] = $fwhostsettings{'SRV_NAME'};
>   		$customservice{$key}[1] = $fwhostsettings{'SRV_PORT'};
> -		$customservice{$key}[2] = $fwhostsettings{'PROT'};
> +		$customservice{$key}[2] = &Header::escape($fwhostsettings{'PROT'});
>   		$customservice{$key}[3] = $ICMP;
>   		&General::writehasharray("$configsrv", \%customservice );
>   		#reset fields
diff mbox series

Patch

diff --git a/html/cgi-bin/fwhosts.cgi b/html/cgi-bin/fwhosts.cgi
index 953f81e5f..a666969b0 100644
--- a/html/cgi-bin/fwhosts.cgi
+++ b/html/cgi-bin/fwhosts.cgi
@@ -2,7 +2,7 @@ 
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2013 Alexander Marx <amarx@ipfire.org>                        #
+# Copyright (C) 2013-2025  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -714,7 +714,7 @@  if ($fwhostsettings{'ACTION'} eq 'savelocationgrp')
 	}
 
 	if ($fwhostsettings{'update'} eq 'on'){
-		@target=$fwhostsettings{'COUNTRY_CODE'};
+		@target=&Header::escape($fwhostsettings{'COUNTRY_CODE'});
 		$type='Location Group';
 
 		#check if host/net exists in grp
@@ -796,7 +796,7 @@  if ($fwhostsettings{'ACTION'} eq 'saveservice')
 		foreach my $i (0 .. 4) { $customservice{$key}[$i] = "";}
 		$customservice{$key}[0] = $fwhostsettings{'SRV_NAME'};
 		$customservice{$key}[1] = $fwhostsettings{'SRV_PORT'};
-		$customservice{$key}[2] = $fwhostsettings{'PROT'};
+		$customservice{$key}[2] = &Header::escape($fwhostsettings{'PROT'});
 		$customservice{$key}[3] = $ICMP;
 		&General::writehasharray("$configsrv", \%customservice );
 		#reset fields